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Abstract 

Onboard  GPS  clock  monitoring  will  be  required  for  GPS  III  satellites .  This  paper 
will  discuss  some  of  the  key  integrity  monitoring  parameters  in  the  context  of  the  GPS 
Block  HR  TKS.  The  paper  will  also  show  that:  (1)  the  phase  meter  output ,  comparing 
the  phase  difference  of  the  Rb  Atomic  Frequency  Standard  (AFS)  and  the  VCXO  in  a 
1.5 -second  GPS  epoch ,  behaves  like  a  Gaussian  distribution;  (2)  The  TKS  probability 
of  false  alarm  is  almost  equal  to  zero  due  to  its  rather  large  detection  threshold;  (3)  The 
TKS  can  detect  and  compensate  for  “ large  ”  VCXO  frequency  steps  with  no  significant 
TKS  output  phase  error;  (4)  The  TKS  cannot  compensate  “ large 99  VCXO  frequency 
drift  steps  and  may  require  a  MCS  (Master  Control  Station)  contingency  upload  to 
remove  phase  bias;  (5)  The  TKS  cannot  detect  “ large ”  AFS  frequency  steps  or 
frequency  drift  steps  that  cause  the  TKS  output  phase  error  to  run  away ,  but  steps  of 
that  type  have  not  be  observed  in  HR  operation  so  far. 


1.  INTRODUCTION 

This  paper  will  evaluate  how  the  GPS  Block  HR  Time  Keeping  System  would  operate  as  an 
integrity  monitoring  system.  There  was  no  integrity  monitoring  requirement  for  the  GPS  HR 
Time  Keeping  System  (TKS),  but  onboard  clock  monitoring  will  be  required  for  GPS  III 
satellites.  The  paper  will  include  the  following  topics:  review  of  GPS  Block  HR  time  keeping 
system  (TKS);  analysis  of  the  GPS  Block  HR  TKS  phase  meter  output;  over-bounding 
cumulative  probability  distribution  function  (CPDF);  evaluation  of  integrity  monitoring 
parameters  for  the  GPS  HR  TKS;  GPS  Block  HR  TKS  integrity  monitoring  considerations; 
consequences  of  large  detection  threshold,  and  a  summary. 


2.  REVIEW  OF  GPS  BLOCK  HR  TIME  KEEPING  SYSTEM 


The  primary  functions  of  the  GPS  Block  HR  Time  Keeping  System  (TKS)  are  to  generate  the 
GPS  frequency  of  10.23  MHz  from  a  Voltage  Control  Crystal  Oscillator  (VCXO),  using  a 
Rubidium  Atomic  Frequency  Standard  (RAFS)  as  an  input  reference,  and  to  accommodate  aging 
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and  the  selective  availability  (SA)  dither  frequency  requirement,  as  shown  in  Figure  1  [1,2]. 
The  Block  HR  TKS  also  incorporates  hardware  monitors  to  detect:  (1)  RAFS  output,  (2)  VCXO 
output,  (3)  whether  the  RAFS  is  frequency-locked,  (4)  the  level  of  RAFS  modulating  signal 
(second  harmonic  level),  and  other  monitors  to  ensure  that  a  single  TKS  component  failure 
cannot  go  undetected  [1], 

The  Block  HR  TKS  has  the  capability  of  adjusting  the  phase,  frequency,  and  frequency  drift  of  its 
online  RAFS.  Residual  RAFS  frequency  offset  and  frequency  drift  are  estimated  by  the  GPS 
Master  Control  Station,  and  their  estimated  corrections  are  provided  in  the  NAV  message  sent  to 
the  user  [3] . 


Figure  1.  Simplified  TKS  block  diagram. 


The  specified  Hadamard  deviations  of  the  three  TKS  major  error  sources  are  shown  in 
Figure  2  [1],  The  actual  measured  performances  are  better  than  the  specifications.  The 
TKS  Phase  Meter  (PM)  uses  a  600  MHz  oscillator  to  measure  phase  difference  between 
the  reference  clock  (RAFS)  and  the  system  clock  (VCXO)  and  results  in  a  resolution  of 
1.67  ns  (1/600  x  106  =  1.67  x  10'9),  which  is  poor  compared  with  a  typical  phase  meter 
resolution  of  better  than  1  ps  (1  x  10"12  s).  Accurate  phase  difference  measurements 
between  AFS  and  VCXO  should  be  a  key  capability  of  future  GPS  clock  integrity 
monitoring  schemes.  The  HR  TKS  loop  constants  were  selected  based  on  trade-offs  to 
attenuate  the  effect  of  the  phase-meter  noise  and  to  take  advantage  of  the  excellent  short¬ 
term  stability  of  the  VCXO  and  long-term  stability  of  the  RAFS. 
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Figure  2.  Hadamard  deviation  of  the  TKS  components. 


The  TKS  loop  filter  is  implemented  in  software,  and  it  can  be  modified  or  tuned.  A  simplified 
HR  TKS  error  model  in  the  S  domain  is  shown  in  Figure  3,  which  will  help  analyze  TKS  system 
responses  subject  to  step  or  ramp  inputs.  The  filter  coefficients  (a,  Kl,  and  K2)  determine  the 
filter  type  and  time  constant  that  can  be  predetermined  and  stored  in  a  lookup  table.  The  other 
coefficient,  aw,  was  added  to  the  control  loop  software  to  handle  VCXO  disturbances  during  and 
around  eclipse  periods  that  occurred  on  SVN  43  [4,5].  It  has  a  value  between  1  and  6  to  weight 
large  phase  errors  and  a  value  between  0.7  and  1  to  weight  smaller  phase  errors  (<  1  ns)  [5].  So 
the  TKS  becomes  an  adaptive  time  constant  (ATC)  system.  However,  for  a  fixed  aw,  the  TKS  is 
still  a  linear  system,  and  all  the  linear  system  techniques/tools  can  be  used. 

There  is  an  integrator,  Kl/S,  shown  in  blue  in  Fig.  3  that  is  used  to  estimate  and  compensate  for 
the  frequency  offset  of  the  VCXO  with  respect  to  the  RAFS  and  to  compensate  for  the  nominal 
drift  of  the  VCXO  with  respect  to  the  RAFS. 
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Figure  3  Simplified  TKS  Error  Model  in  S  Domain 


3.  ANALYSIS  OF  THE  GPS  BLOCK  HR  TIME  KEEPING 
SYSTEM  (TKS)  PHASE  METER  MONITOR  OUTPUT 

The  TKS  is  a  phase-locked  loop  using  a  phase  meter  to  measure  the  phase  difference  between  the 
VCXO  and  the  RAFS.  Any  transient  or  anomaly  from  either  the  VCXO  or  RAFS  will  result  in 
phase  build-up  at  the  phase  meter  output.  If  necessary,  the  TKS  can  protect  users  from  using  the 
degraded  GPS  signals  by  quickly  switching  to  nonstandard  codes  within  seconds  of  detected 
failure. 

The  TKS  raw  phase  meter  error  data  can  be  recorded  every  1.5  seconds  (GPS  Epoch)  in  the 
satellite  data  buffer  and  dumped  to  the  ground  station  during  satellite  contact  by  the  GPS  Master 
Control  Station  in  Colorado  Springs,  CO.  This  is  normally  done  once  or  twice  per  day,  and  each 
time  takes  10  to  15  minutes.  ITT  at  the  Master  Control  Station  provided  recorded  GPS  SVN  51 
TKS  raw  phase  meter  error  for  the  month  of  December  2005  with  a  total  of  34412  points  (14.34 
hours  of  data).  Since  there  were  no  clock  anomalies  during  that  period,  the  TKS  can  be  assumed 
to  be  operating  in  a  benign  condition.  The  recorded  data  from  SVN  51  are  shown  in  Figure  4. 
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Figure  4.  Raw  TKS  phase  meter  noise. 


The  December  2005  data  set  has  a  mean  PM  noise  of  -4.2714  x  10"11  seconds,  with  standard 
deviation  (a)  of  7.2740  x  10"10  seconds.  Plots  of  the  cumulative  probability  distribution  function 
(CPDF)  of  this  data  set  and  a  MATLAB-generated  Normal  distribution  data  set  with  the  same 
mean  and  sigma  (a)  are  provided  in  Figure  5.  The  figure  shows  that  the  TKS  record  set  (red  line) 
appears  to  have  a  Normal  distribution.  The  TKS  CPDF  shows  many  steps  because  the  TKS 
output  data  only  contain  three  significant  bits,  so  there  are  multiple  points  recorded  for  the  same 
data  value.  For  example,  there  are  10  measurements  of  the  same  value  of  6.27  x  10"10  seconds. 
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Probability  distribution 


TKS  Data  points,  seconds  x  io'9 


Figure  5.  Cumulative  probability  functions. 


4.  OVER-BOUNDING  CUMULATIVE  PROBABILITY 
DISTRIBUTION  FUNCTION  (CPDF) 

ITT  also  provided  two  more  sets  of  TKS  raw  phase  meter  error  data  from  SVN  54  and  SVN  44. 
The  cumulative  probability  distribution  functions  from  SVN  51  (black),  SVN  54  (red  line),  and 
SVN  44  (green  line)  are  shown  in  Figure  6.  They  all  have  the  same  standard  deviation  of  0.73  ns, 
but  their  means  are  slightly  different.  This  family  of  CPDFs  can  be  over-bounded  by  a  Normal 
distribution  with  a  standard  deviation  of  0.88  ns  and  a  zero  mean,  as  shown  in  Figure  6.  The 
over-bounding  CPDF  [6]  technique,  which  is  used  by  the  analysts  on  the  FAA  WAAS  and 
LAAS  programs,  can  be  used  to  conservatively  estimate  the  CPDF  of  the  HR  TKS  phase 
meter  output  noise  distribution.  It  is  a  conservative  representation  of  the  data  distribution  that 
defines  the  worst  possible  case  in  the  absence  of  a  hardware  fault.  The  Normal  distribution  is 
recommended  for  over-bounding  because  of  its  well-known  probability  distribution 
characteristics. 
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TKS  Data  points,  seconds  x  io'9 


Figure  6.  Over-bounding  cumulative  probability  distribution  function. 


5.  INTEGRITY  MONITORING  PARAMETERS  TO  EVALUATE 
HR  TKS 

The  key  integrity  monitoring  parameters  [7]  that  will  be  used  to  evaluate  the  GPS  Block  HR  TKS 
are  shown  in  Figure  7.  It  is  more  convenient  to  work  with  probability  density  functions  than 
cumulative  probability  distribution  functions  for  this  type  of  analysis.  The  probability  density 
function  with  no  bias  represents  a  normal  TKS  phase  meter  output  with  no  failure.  The 
probability  density  function  with  a  bias  represents  a  TKS  failure  condition.  These  two  probability 
density  functions  could  be  slightly  different  because  of  the  use  of  an  adaptive  time  constant.  The 
weighting,  aw,  has  a  value  between  1  and  6  to  weight  large  phase  errors  and  a  value  between  0.7 
and  1  to  weight  smaller  phase  errors  (  <  1  ns).  When  failure  occurs,  aw  is  normally  set  to  6  to 
correct  for  large  phase  errors  more  quickly. 

The  other  key  integrity  parameters  are  defined  below: 

•  Probability  of  false  alarm  (Pfa)  -  the  probability  of  issuing  an  alarm  when  there  is  no 
failure. 

•  Detection  threshold  (TD)  -  if  the  magnitude  of  phase-meter  output  is  greater  than  or 
equal  to  this  value  for  a  specified  time,  then  an  alarm  will  be  issued  to  indicate  that  the 
TKS  [TKS  or  AFS?]  is  not  working  properly. 
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•  Probability  of  missed  detection  (Pd)  -  the  probability  that  the  failure  magnitude  is 
greater  than  or  equal  to  the  alert  limit  and  an  alarm  is  not  issued. 

•  Probability  of  detection  =  1  -  probability  of  missed  detection. 

•  Protection  Level  -  The  protection  level  is  the  magnitude  of  a  failure  that  can  be 
determined  with  given  probability  of  detection  and  failure  probability  distribution 
function.  When  the  magnitude  of  the  failure  is  greater  than  the  protection  level,  its 
probability  of  detection  will  be  greater  than  the  specified  probability  of  detection. 

•  Alert  Limit  -  Alert  Limit  is  the  threshold  or  objective  for  the  protection  level. 


Figure  7.  Integrity  monitoring  parameters. 


6.  GPS  BLOCK  HR  TKS  INTEGRITY  MONITORING 
CONSIDERATION 

There  is  no  integrity  monitoring  requirement  for  the  Block  HR  TKS.  However,  the  HR  TKS  has 
software  logic  to  switch  to  nonstandard  code  when  the  absolute  value  of  the  phase-meter  output  is 
larger  15.84  ns  [8].  This  value  of  15.84  ns  can  be  considered  to  be  the  detection  threshold  of  the 
HR  TKS  system.  The  over-bounding  probability  distribution  function  of  the  HR  TKS  phase 
meter  has  a  Gaussian  distribution  with  zero  mean  and  a  standard  deviation  of  0.88  ns  (la),  as 
shown  in  Section  3.  Since  15.84  ns  is  greater  than  17  a  (14.96  ns),  the  probability  of  false  alarm 
for  the  HR  TKS  is  zero. 

Even  though  the  Alert  Limit  and  probability  of  missed  detection  are  not  specified  for  the  HR 
TKS,  their  effective  paired  values  can  be  determined.  For  example,  assuming  the  over-bounding 
probability  distribution  of  the  HR  TKS  with  failure  is  the  same  as  that  with  no  failure,  then  it 
remains  a  Normal  distribution,  N  (0.0  ns,  0.  88  ns),  and  the  Alert  Limit  is  selected  as: 

Alert  Limit  =  15.84  ns  +  6  a  =  21.12  ns 
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Since  the  probability  of  Normally  distributed  noise  exceeding  six  sigma  (a)  is  less  than  1  x  10"8, 
the  corresponding  probability  of  missed  detection  <  1  x  10'8.  In  other  words,  the  probability  of 
detecting  an  HR  TKS  absolute  phase-meter  output  error  of  more  than  21.12  ns  is  greater  than  1- 
1  x  IQ'8. 


7.  CONSEQUENCES  OF  LARGE  DETECTION  THRESHOLD 

The  detection  threshold  of  the  HR  TKS  is  greater  than  17a,  and  that  is  rather  large.  The 
consequences  of  this  rather  large  detection  threshold  are  that  some  of  the  large  frequency  jumps 
and  frequency  drift  jumps  from  either  the  VCXO  or  the  RAFS  would  go  undetected.  The 
following  results  were  obtained  using  a  MATLAB  GPS  Block  HR  TKS  simulation  program. 

The  HR  TKS  will  set  NSC  if  the  frequency  jumps  and  frequency  drift  jumps  of  VCXO  or  RAFS 
exceed  the  following  limits: 

a.  VCXO  frequency  jump  >  1.2  x  10'9 

b.  VCXO  frequency  drift  jump  >7.1  x  10'12/s 

c.  RAFS  frequency  jump  >  1.2  x  10"9 

d.  RAFS  frequency  drift  Jump  >7.1  x  10"12/s 

However,  after  a  VCXO  frequency  jump  of  1.1  x  10“9,  the  TKS  will  not  set  nonstandard  code 
(NSC).  The  result  is  depicted  in  Figure  8.  There  is  a  transient  response  in  the  phase-meter  output 
and  TKS  output  (less  than  14.8  ns  or  4.44  m)  and  it  settles  to  zero  mean  after  20  minutes. 


Phase  Meter  and  TKS  Outputs  Due  to  VCXO 
Frequency  Jump  of  (1  .IE-9)  but  TKS  will  not 
transmit  NSC 


Figure  8.  TKS  phase  transients  due  to  a  VCXO  frequency  jump. 
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After  a  VCXO  frequency  drift  jump  of  6.9  x  ft)"12  /s,  the  TKS  will  not  set  NSC.  The  result  is 
shown  in  Figure  9.  As  a  result,  there  will  be  a  4.5  m  bias  that  will  be  observed  by  the  master 
control  station  (MCS)  at  Colorado  Springs  and  will  require  MCS  contingency  upload  to  reduce 
this  large  bias  error. 


Phase  Meter  and  TKS  Phase  Output  Due 
VCXO  Frequency  Drift  Step  of  6.9E-12/S  but 
TKS  will  not  transmit  NSC 


Figure  9.  TKS  phase  transients  due  to  a  VCXO  frequency  drift  jump. 


After  a  RAFS  frequency  jump  of  1.1  x  10'9or  frequency  drift  Jump  of  6.9  x  10'12/s,  the  TKS  will 
not  set  NSC.  The  result  is  shown  in  Figure  10.  The  TKS  output  phase  is  running  away,  and  the 
MCS  cannot  reduce  the  magnitude  of  this  error  in  time  by  a  contingency  upload  or  a  system  zap 
to  take  the  satellite  off  the  air.  If  at  least  six  satellites  are  in  view,  this  type  of  error  could  be 
detected  and  excluded  by  the  Receiver  Autonomous  Integrity  Monitoring  (RAIM),  in  which  case 
this  GPS  signal  would  not  be  used. 


8.  SUMMARY 

The  results  of  evaluation  of  the  GPS  Block  HR  TKS  for  integrity  monitoring  can  be  summarized 
as: 

The  HR  TKS  phase  meter  output  noise  distribution  behaves  like  a  Gaussian  distribution 

a.  The  HR  TKS  phase-meter  output  noise  can  be  over-bounded  by  a  Gaussian  distribution. 

b.  The  HR  TKS  detection  threshold  (failure  threshold)  is  effectively  set  at  17.9  a  (too  large). 

a.  The  HR  TKS  false  alarm  probability  ~  0.0  /sample  ~  0.0  /hour 
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TKS  Outputs  Due  to  AFS  Frequency  Jump  (1.1  E- 
9)  and  Drift  Jump  (6.9E-12/s)  and  TKS  will  not 
transmit  NSC 


Figure  10.  TKS  phase  runaway  due  to  a  RAFS  frequency  jump  and  frequency  drift  jump. 


c.  The  HR  TKS  alert  limit  and  missed  detection  probability  are  not  specified,  but  can  be 
computed  when  the  failure  probability  distribution  is  known  and  the  probability  of  missed 
detection  is  specified. 

d.  The  HR  TKS  phase-meter  output  noise  distribution  behaves  like  a  Gaussian  distribution. 

e.  The  HR  TKS  phase-meter  output  noise  can  be  over-bounded  by  a  Gaussian  distribution. 

f.  The  HR  TKS  detection  threshold  (failure  threshold)  is  effectively  set  at  17.9  a  (too  large). 

a.  The  HR  TKS  false  alarm  probability  ~  0.0  /sample  ~  0.0  /hour 

g.  The  HR  TKS  alert  limit  and  missed  detection  probability  are  not  specified,  but  can  be 
computed  when  the  failure  probability  distribution  is  known  and  the  probability  of  missed 
detection  is  specified. 

h.  The  HR  TKS  can  detect  and  compensate  large  VCXO  frequency  jumps  with  no 
significant  TKS  phase  error. 

i.  Large  VCXO  frequency  drift  jumps  may  not  trigger  NSC,  and  may  require  MCS 
contingency  upload  to  remove  phase  bias. 

j.  Large  RAFS  frequency  jumps  and  frequency  drift  jumps  may  not  trigger  NSC  and  will 
cause  the  TKS  phase  to  run  away.  However,  but  these  large  jump  anomalies  have  never 
be  observed  in  real  HR  RAFS  operation  so  far. 

-  will  be  detected  by  RAIM 

-  Will  be  detected  by  MCS  but  not  in  time  to  warn  user. 
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